6. Failing to test noncritical applications for basic vulnerabilities.
Nearly 80 percent of all hacking attacks are the result of security holes in Web applications, according to the Verizon Business report. Network managers know that their biggest vulnerability is in Web applications, so they put all of their effort into testing their critical and Internet-facing systems.
The problem is that most hacking attacks leverage security mistakes in noncritical systems inside networks. "The main problem is that we're testing like crazy the critical Web applications, and we're not testing the non-Web applications," Tippett says. He recommends that network managers test all of their applications for basic vulnerabilities.
"People have been taught forever to focus in order of criticality, but the bad guys don't know what's critical or not. They go in order of what's easy," Tippett says. "Once they get inside your network, they can set up shop, take their time and watch your traffic."
7. Not adequately protecting your servers from malware.
Malware on servers accounts for 38 percent of all security breaches, Verizon Business says. Most malware is installed by a remote attacker and is used to capture data. Typically, malware is customized, so it can't be discovered by antivirus software. One way for network managers to find malware such as keylogger or spyware on their servers is to run host-based intrusion-detection system software on every server, not just critical servers.
Tippett suggests a simple way to prevent many of these attacks: Lock down servers so that no new applications can run on them. "Network managers hate to do that because they might want to add new software later," Tippett says. "I tell them to just unlock the lock, install the new software, and then lock it up again."
8. Failing to configure your routers to prohibit unwanted outbound traffic.
One popular form of malware involves putting a backdoor or command shell on a server. One way to prevent a hacker from taking advantage of a backdoor or command shell is network segmentation using access control lists. This way you can prevent servers from sending traffic that they shouldn't be sending. For example, a mail server should only send mail traffic, not SSH traffic. Another option is to use your routers for default deny egress filtering, which blocks all outbound traffic except for what you want leaving your network.
"Only 2 percent of companies do this. It baffles me as to why the other 98 percent don't," Tippett says. "Default deny egress filtering is trivial."
9. Not knowing where credit card or other critical customer data is stored.
Most companies think they know where critical data such as credit card information, Social Security numbers or other personally identifiable information are stored, and they harden these servers with the highest levels of security. But often, this data is stored somewhere else on the network such as at a backup site or in the software development department.
It's these secondary, noncritical servers that often get attacked and lead to the majority of data breaches. One easy way to find out where critical data is stored is to conduct network discovery. "We typically stick a sniffer on the network and we see where the critical data is supposed to be and then we see where else it goes," Tippett says.
10. Not following the Payment Card Industry Data Security Standards.
Dubbed PCI DSS, this set of 12 controls for protecting cardholder information work, Tippett says. "Most people don't even try to meet the PCI standards," Tippett says. Sometimes a company follows these controls for the servers where it knows it stores credit card data, but not on the other unknown servers that host this critical data.
Even though 98 percent of all compromised records involve payment card data, only 19 percent of organizations with security breaches followed the PCI standards, according to the Verizon Business report. "It's obvious. Follow the PCI rules. They basically work," Tippett says.